Loading story…
U.S. public company directors are increasingly using generative AI tools for board-related work without formal oversight, raising concerns that sensitive corporate information is being exposed through unapproved platforms. The latest Director Confidence Index from Diligent Institute and Corporate Board Member found that 82% of directors use generative AI for board work, while 69% said their organizations have no formal AI policy and only 6% reported a policy specifically covering board AI use.
Directors are reportedly using consumer services such as ChatGPT and Claude to summarize board books and meeting materials that may contain proprietary and confidential information, creating privacy, security, and legal discovery risks because prompts and generated content could be subpoenaed in litigation. The reports say the problem is compounded by directors often working on personal or non-corporate devices, and they urge CIOs to coordinate with legal teams and boards to assess current usage, deploy secure governance-specific AI tools separated from public models, and establish board-specific policies and training.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The latest Director Confidence Index from Diligent Institute and Corporate Board Member found that 82% of U.S. public company directors use generative AI for board work, while 69% report having no formal AI policy and only 6% have a policy specific to board AI use. The reporting highlights that directors are using consumer tools such as ChatGPT and Claude with potentially sensitive board materials, creating privacy, security, and legal discovery risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcediligent.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are facing a growing challenge as employees increasingly adopt AI tools and agents without formal IT approval, a phenomenon known as shadow AI. This unsanctioned use of AI—ranging from chatbots and large language models to low-code agents—enables employees to automate workflows and make decisions outside traditional governance structures. The lack of oversight and visibility into these autonomous systems exposes enterprises to significant risks, as sensitive data may be processed or shared through unvetted platforms, and decisions may be influenced by tools that operate beyond established security controls. Recent research highlights that 73% of employees use AI for work, yet over a third do not consistently follow company policies, and many are unaware of existing guidelines. About 27% admit to using unapproved AI tools, often browser-based and free, making them difficult for IT to monitor. This shadow AI trend compounds the broader issue of shadow IT and SaaS sprawl, where employees bypass official channels to access tools that better meet their needs. Security teams are advised to shift from outright bans to strategies focused on discovery, communication, and oversight to manage these risks effectively.
Jul 1, 2026
Organizations are rapidly adopting AI-powered tools and agents across business processes, often without adequate oversight or security controls. As AI agents become more autonomous, they are increasingly granted access to sensitive systems, data, and workflows, sometimes without formal approval or visibility from IT and security teams. This phenomenon, known as 'Shadow AI,' introduces significant blind spots for traditional security tools, as these agents can operate with hidden identities and privileges. Studies have shown that a large proportion of enterprise employees use generative AI tools like ChatGPT, frequently pasting sensitive information such as personally identifiable information (PII) and payment card data into these platforms, often through unmanaged personal accounts. This uncontrolled usage creates substantial risks of data leakage, compliance violations, and potential misuse of corporate data for AI model training. Security research highlights that 45 percent of enterprise employees use generative AI tools, with 77 percent of those users copying and pasting data into chatbots, and 22 percent of those pastes containing PII or PCI data. Furthermore, 40 percent of file uploads to generative AI sites include sensitive data, with a significant portion coming from non-corporate accounts, making it difficult for organizations to monitor or control data exfiltration. The rise of autonomous AI agents, capable of acting independently and integrating with APIs and workflows, further complicates the security landscape, as these agents can trigger actions and access data without direct human oversight. Industry experts warn that unchecked proliferation of AI agents could lead to disastrous consequences, including unauthorized access to business processes and sensitive information. The OpenID Foundation and other organizations are calling for the development of AI-specific identity and access management standards to address these risks. Ethical considerations are also paramount, as the design and deployment of AI agents must prioritize principles such as transparency, accountability, and alignment with human values to prevent costly errors and security incidents. Security leaders are urged to extend governance practices to cover AI agents, implement robust monitoring and access controls, and foster a culture of cybersecurity awareness to mitigate the risks posed by shadow AI. The convergence of technical, regulatory, and ethical challenges underscores the urgent need for coordinated action to secure the expanding ecosystem of AI agents within enterprises.
Jun 29, 2026
Security leaders are warning that rapid adoption of AI tools—often outside formal governance—creates expanding blind spots and increases the likelihood of **data leakage** and operational incidents. A webcast discussion framed “**Shadow AIT**” as the AI-era evolution of shadow IT, highlighting that AI capabilities are frequently embedded in everyday SaaS features and browser extensions, making it difficult for organizations to accurately inventory where AI is in use and what data is being shared. The panel cited a cautionary example involving *Replit* where insufficient controls around an AI agent reportedly contributed to a production database deletion, underscoring that agentic workflows can translate governance gaps into real outages. Separately, reporting on *Google Vertex AI* raised concerns that **permissions and access control design** in AI platforms can amplify **insider-risk** scenarios if roles, entitlements, and auditability are not tightly managed—particularly where AI services can access or act on sensitive datasets. Commentary-style content also broadly discusses “cognitive AI” and future-facing architectures, but without tying to a specific incident or disclosure; the actionable takeaway across the relevant items is to treat AI enablement as an identity, data-governance, and monitoring problem (inventory AI usage, constrain permissions, and instrument logging) rather than a purely productivity tooling decision.
Jun 29, 2026